Network monitoring and diagnostics

Abstract

Techniques are provided for monitoring and diagnosis of a network comprising one or more devices. In some embodiments, techniques are provided for gathering network information, analyzing the gathered information to identify correlations, and for diagnosing a problem based upon the correlations. The diagnosis may identify a root cause of the problem. In certain embodiments, a computing device may be configurable to determine a first event from information, allocate a first event to a first cluster, the first cluster is from one or more clusters of events, based on a set of attributes for the first event, and determine a set of attributes for the first cluster, and rank the first cluster against the other clusters from the one or more clusters of events based on the set of attributes for the first cluster. The set of attributes may be indicative of the relationship between events in the cluster. In some embodiments, one or more recommendations may be provided for taking preventative or corrective actions for the problem.

What is claimed is: 
     
       1. A computing device comprising one or more processing units configured to:
 determine a first event from information; 
 allocate the first event to a first cluster from one or more clusters of events, based on a set of attributes associated with the first event, the set of attributes comprising:
 location information indicative of a location in a network where the first event occurred; and 
 time information indicative of a time when the first event occurred in the network; 
 
 determine a set of attributes for the first cluster; and 
 rank the first cluster against other clusters from the one or more clusters of events based on the set of attributes for the first cluster and a set of attributes for the other clusters from the one or more clusters, wherein a timestamp of a last event added to each cluster is one of the set of attributes for each cluster from the one or more clusters. 
 
     
     
       2. The computing device of  claim 1 , wherein the set of attributes for the first cluster are indicative of a relationship between a plurality of events from the first cluster. 
     
     
       3. The computing device of  claim 2 , wherein the relationship between the plurality of events from the first cluster is unknown prior to a formation of the relationship. 
     
     
       4. The computing device of  claim 1 , wherein the set of attributes for the first event further comprises one or more categories indicating information associated with the first event, wherein the one or more categories comprises one or more of a hardware error category, a software error category, a performance category, a permissions category or a topology category. 
     
     
       5. The computing device of  claim 1 , wherein the first event is one of a raw event, a derived event or a topology event. 
     
     
       6. The computing device of  claim 1 , wherein the network comprises a topology of one or more network level nodes in a network topology or device level nodes in a device topology. 
     
     
       7. The computing device of  claim 1 , wherein the one or more processing units are configured to:
 determine a distance between the first event and the first cluster, wherein the distance determined between the first event and the first cluster is indicative of a probability that the first event and the first cluster are directly related to each other; and 
 allocate the first event to the first cluster if the distance is below a distance threshold. 
 
     
     
       8. The computing device of  claim 7 , wherein the determining the distance between the first event and the first cluster comprises:
 determining, by the one or more processing units, a shortest distance between the first event and each of one or more events from the first cluster based upon a set of attributes associated with the first event and each event of one or more events from the first cluster. 
 
     
     
       9. The computing device of  claim 8 , wherein the one or more events from the first cluster are the events that occurred in a past pre-determined period of time. 
     
     
       10. The computing device of  claim 1 , wherein the first cluster is removed from memory if the timestamp of the last event added to the cluster is older than a time threshold. 
     
     
       11. A method comprising:
 determining, by one or more processing units, a first event from information; 
 allocating, by the one or more processing units, the first event to a first cluster from one or more clusters of events, based on a set of attributes associated with the first event, the set of attributes for the first event comprising:
 location information indicative of a location in a network where the first event occurred; and 
 time information indicative of a time when the first event occurred in the network; 
 
 determining, by the one or more processing units, a set of attributes for the first cluster; and 
 ranking, by the one or more processing units, the first cluster against other clusters from the one or more clusters of events based on the set of attributes for the first cluster, wherein a timestamp of a last event added to each cluster is one of a set of attributes for each cluster. 
 
     
     
       12. The method of  claim 11 , wherein the set of attributes for the first cluster are indicative of a relationship between a plurality of events from the first cluster. 
     
     
       13. The method of  claim 12 , wherein the relationship between the plurality of events from the first cluster is unknown prior to a formation of the relationship. 
     
     
       14. The method of  claim 11 , wherein the set of attributes for the first event further comprises one or more categories indicating information associated with the first event, wherein the one or more categories comprises one or more of a hardware error category, a software error category, a performance category, a permissions category or a topology category. 
     
     
       15. The method of  claim 11 , wherein the method comprises:
 determining a distance between the first event and the first cluster, wherein the distance determined between the first event and the first cluster is indicative of a probability that the first event and the first cluster are directly related to each other; and 
 allocating the first event to the first cluster if the distance is below a distance threshold. 
 
     
     
       16. A computing device comprising one or more processing units configured to:
 determine a first event from information; 
 allocate the first event to a first cluster from one or more clusters of events, based on a set of attributes associated with the first event, the set of attributes comprising:
 location information indicative of a location in a network where the first event occurred; and 
 time information indicative of a time when the first event occurred in the network; 
 
 determine a set of attributes for the first cluster comprising a goodness associated with the first cluster, wherein the goodness associated with the first cluster indicates how closely related events of the first cluster are to each other; and 
 rank the first cluster against other clusters from the one or more clusters of events based on a number of the events in the first cluster and the set of attributes for the first cluster. 
 
     
     
       17. A computing device comprising one or more processing units configured to:
 determine a first event from information; 
 allocate the first event to a first cluster from one or more clusters of events, based on a set of attributes associated with the first event, the set of attributes comprising:
 location information indicative of a location in a network where the first event occurred; and 
 time information indicative of a time when the first event occurred in the network; 
 
 determine a set of attributes for the first cluster; and 
 rank the first cluster against other clusters from the one or more clusters of events based on the set of attributes for the first cluster and a set of attributes for the other clusters form the one or more clusters, wherein the ranking comprises ranking the one or more clusters of events for each severity level associated with one or more events from the one or more clusters of events. 
 
     
     
       18. A computing device comprising one or more processing units configured to:
 determine a first event from information; 
 allocate the first event to a first cluster from one or more clusters of events, based on a set of attributes associated with the first event, the set of attributes comprising:
 location information indicative of a location in a network where the first event occurred; and 
 time information indicative of a time when the first event occurred in the network; 
 
 determine a set of attributes for the first cluster; 
 rank the first cluster against other clusters from the one or more clusters of events based on the set of attributes for the first cluster; 
 determine if the first cluster is ranked amongst a pre-determined number of highest ranked clusters from the one or more clusters; and 
 provide one or more events from the first cluster for displaying through a user interface. 
 
     
     
       19. A computing device comprising one or more processing units configured to:
 determine a first event from information; 
 allocate the first event to a first cluster from one or more clusters of events, based on a set of attributes associated with the first event, the set of attributes comprising:
 location information indicative of a location in a network where the first event occurred; and 
 time information indicative of a time when the first event occurred in the network; 
 
 determine a set of attributes for the first cluster; and 
 rank the first cluster against other clusters from the one or more clusters of events based on the set of attributes for the first cluster, wherein the first cluster comprises a most significant event in the cluster and the most significant event in the first cluster is an event with an earliest timestamp amongst the events of the first cluster.